We didn't chase. I think in hindsight and I think now we would probably be much more proactive because I think we recognise and sympathise with customers that were hacked and we would really want them to know about that. So what we need to get to is circumstances ...

We've had no response to that.

We were in a similar position, where we did not know that those customers were the victims of phone hacking, so we have a large number of callers that the hacker potentially called, and actually all we knew was that the call diverted to voicemail, so we don't even ...

Yes.

We contacted all of those customers in July 2011, so that was after we had received the information from the police that verified which were the victims of phone hacking. Up to that point, we didn't have that verification from the police.

We had 45 customers that we identified on the Orange network. That's where the call-in number had accessed those 45 numbers and accessed the voicemail box, that was 45 on Orange, and on T-Mobile it was 71.

For security, data security is a top priority for our business. It's a priority for the board, it's a priority for everyone who's working for products and services. We have a kind of three-point approach to data security. The first thing is just to cleanse information in ...

There will be other cases and those will be dealt with through our disciplinary procedures, but we don't have records of exactly how many cases.

So the number of people that have been dismissed and prosecuted across both brands is four people in the last I think it is five years. We don't have records of other disciplinaries. We only know about those ones where we have initiated an investigation, contacted the police and ...

Yes.

(Nods head).

It's a similar position, customer services agents would only supply billing data to the genuine customer. We recognise that we need to do more to make customer service agents aware of blagging, so we have a training programme running out, we have videos that they watch that shows examples ...

That's always been the case.

Again, customer service agents wouldn't have access to specific location information, for example PIN type information. That's very restricted. It's within a specific police liaison team within our organisation that sits in my team. There's about 20 people in each of the Orange and T-Mobile organisations.

No.

I have to be honest, I don't know what our knowledge was of Mr Nott at that time. That was a long time before the scandal erupted around the Mulcaire hacking. I think we have reacted quickly, and I think we always have a continuous programme of improvement. Security ...

That's true, but somebody can still guess the number. So yes, you're right, unless you set it up. But it's the people that set it up and then want to disconnect it, they'll be able to do that.

As I said, we have a new voicemail platform that we're putting in place which should actually be complete in the next few months and that will have a number of enhanced features. The real problem is the unauthorised access, so every time the voicemail box is accessed remotely ...

I think also to be fair customers want a balance between usability and security, so if you tell them they have to have a ten digit PIN number to get into their voicemail, they'll find it quite difficult.

I know that's part of the new platform, so that will prevent that from happening going forward. You won't be able to have dual access to the same box.

I think that's something that's in the process to align the two brands. I don't think that's the case currently.

On T-Mobile it will drop, so after three unsuccessful attempts it will disconnect and there will then be a 30 minute gap and they will be able to retry after that. We are trying to align the systems, so we have a complete new voicemail platform that's intended to ...

That's always been the case on Orange.

Yes, similar system. If there are three unsuccessful attempts, then the voicemail will block and they would have to call into customer services to reset it and go through security checks.

The only thing I'd add to that is we also now have a process where if a customer service agent suspects that they're not talking to the genuine customer, they have a process whereby they will call the customer. So if they can go through a conversation, terminate ...

Our customer service agents are now being trained specifically on this issue, so there's a heightened awareness with our customer service agents. We also have training specifically for blagging. So they would know not to allow a customer to put their date of birth, and if there was a ...

As part of our changes, we would actually restrict what we call easily guessable PINs. So you wouldn't be allowed a PIN that was say 0000 or 1234. So the enhanced security we're putting in place will hopefully close that down as well.

Yes. I think it's fair to say that security has always been important to us. It's a significant issue for us, as it is for our customers, so we're always looking to improve that. That was an initiative we put in place in 2006 and we have ...

That's since 2006, that's a change that we've put in place.

If somebody socially engineers the account and convinces the customer service agent and changes the PIN for their own purposes, a text will be sent back to the customer phone, so the customer, who obviously isn't the party that's blagging the account, would be notified.

Yes.

That's always been the case.

The PIN is not visible and never has been visible to the customer service agent in the system, so it's not stored in the system. They would know because of the conversation because they'd set the PIN at that time what that PIN was, but it wouldn't ...

So customers who want to set up their voicemail will call customer services and they can put their own unique PIN on at that point in time, so if they do that, then it will be secure.

We also now have a system where if somebody calls in in those ...

Correct.

Yes.

I don't know precisely, but I can only imagine the feeling was that it would add to the security if there was no default PIN.

Orange has never had a default PIN. T-Mobile had default PIN prior to 2002, and that was taken away late 2002.

I believe that's the case, yes.

Yes.

Yes.

Vice-president for legal and regulatory affairs for Orange and T-Mobile. I've been in that position since the merger in 2010. Previously in a similar position for T-Mobile.